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SUMMARY 


The INSIM computer program is described which simulates the "limited 
fatigue life" environment in which aircraft structures generally operate 
The use of INSIM to develop inspection strategies, which aim to minimize 
service failures, is demonstrated. Damage-tolerance methodology, 
inspection thresholds and customized inspections are simulated using the 
probability of failure as the driving parameter. 


INTRODUCTION 


Aircraft structures generally have a limited fatigue life. Sooner or 
later, cracks develop at critical locations. These cracks propagate and, 
unless detected and repaired, will eventually result in a failure. There 
are three, mutually exclusive, possible outcomes of the fatigue process: 

(1) The aircraft may reach the end of its operational life and be 
retired from service. The retired aircraft may or may not have 
undetected cracks at critical locations. 

(2) A crack may be detected during maintenance operations. The 
affected part is usually repaired or replaced. 

(3) A crack reaches its critical size undetected and the structure 
fails in service. 

It is the aim of the fatigue engineer to minimize the probability of 
failure during the service life. Damage-tolerance methodology serves 
this purpose by requiring or encouraging the following: 

(1) Moderate stress levels resulting in long crack initiation and 
propagation lives; 

(2) rationally determined NDI methods and intervals; 

(3) fail-safe or crack-arrest design features to avoid catastrophic 
fail ures . 

However, over the past 10-15 years, a trend has developed in which 
aircraft are being operated much longer before retirement. For many 
aircraft models, high-time aircraft greatly exceed original design life 
goals (Reference 1). With increased service usage, the NDI methods and 



intervals originally specified may prove to be inadequate for avoiding 
failures and new strategies must be developed in order to minimize 
failures in service. 


SIMULATION OF THE FATIGUE PROCESS AND ITS DETECTION 


A simulation method has been developed to provide strategies for the 
optimum scheming of structural inspections. The INSIM (INspection 
SIMul ati on) computer program has been written to simulate the "limited 
fatigue life environment. Using INSIM, various inspection methods and 
intervals can be evaluated for selected parameters, and the resultinq 
probability of failure can be determined. 

INSIM contains four probabilistic simulations: 

(1) Service life variation is provided by a normal distribution 
defined by a mean and high-time (+3 o) expected service life. 

(2) Crack initiation life is described by a two-parameter (shape 
factor and characteri stic life) Weibull distribution. 

(3) Crack growth variation is characterized by a normal distribution 
defined by a mean rate and an extreme (±3a) variation. 

(4) NDI probability of detection is modelled by a three-parameter 
(shape factor, characteri stic length and minimum detectable 
length) Weibull distribution. 

INSIM performs a simulation of a single critical location in an entire 
fleet of aircraft. Cracks initiate at various times and grow at variable 
rates in each aircraft. Inspections are performed according to a 
predetermined schedule, using as many as six different NDI methods. 

Cracks are detected during these inspections according to the statistical 
expectation of detection. As the simulation proceeds from aircraft to 
aircraft, cracks are detected, aircraft are retired from service or 
failures occur. The computer acts as a scorekeeper, amasses the 
statistics and summarizes the results. In order to provide statistical 
significant results, a large number of simulations must be performed. In 
a typical simulation, 100,000 inspections will be performed for a fleet 
of 30,000 aircraft. 


The program determines, for the parameters selected: 

(1) The probability of an aircraft reaching retirement, uncracked at 
the critical location. 

(2) The probability of an aircraft retiring with an undetected crack. 

(3) The probability of detecting a crack before it reaches the size 
dictated by the damage-tolerance regulations. 



(4) The probability of detecting a crack larger than the above, but 
less than the size required for failure. 

(5) The probability of a failure occurring during the service life. 

Based on these results, optimum NDI methods and intervals can be 
selected to provide a required level of safety and cost effectiveness. 

A typical INSIM output is shown in Table 1. 

The method is especially well suited for developing inspection 
strategies for multiple-site or widespread fatigue damage situations. 


Table 1. A Typical Example of INSIM Results 


SUMMARY & STATISTICS 

Fleet size: 30000 Threshold: 10000 

Mean service life: 29965 

Min. crack initiation: 7104 

Min. crack growth: 11376 

Inspections performed: 164488 


Interval (s): 4000 


High-time aircraft: 

45463 

Max. crack initiation: 

150598 

Max. crack growth: 

17285 

Inspections per aircraft: 

5.48 



Number of Aircraft 

Percent 

Aircraft retired uncracked: 

29309 

97.70% 

Aircraft retired cracked: 

494 

1.65% 

Cracks < Ap detected: 

187 

0.62% 

Cracks > Ap detected: 

3 

0.0100% 

Fai 1 ures : 

7 

0.02333% 


SELECTING INSPECTION STRATEGIES USING INSIM 


The INSIM computer program can be used to select inspection strategies 
that minimize the probability of failure in service. Several examples 
will be shown to demonstrate this feature. 
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The Primary Strategy — Damage-Tolerance Methodology 


The damage-tolerance regulations implicitly require the use of 
moderate stress levels and rationally determined NDI methods and 
intervals. This results in several benefits such as: long crack 
initiation lives, long crack growth lives, relatively large critical 
crack sizes and ample opportunities to detect cracks. Thus, damage 
tolerance methodology can be considered to be the primary strategy 
for minimizing service failures. 

Figure 1 compares the probability of failure for a typical location 
designed to damage-tolerance requirements compared to one designed to 
safe-life requi rements . 


PROBABILITY OF FAILURE (%) 



MEAN SERVICE LIFE / DESIGN LIFE 


Figure 1. Effect of mean service life on the probability of failure. 
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The safe-life requirements assume a mean crack initiation life of two 
design lifetimes and an inspection interval of half the design lifetime. 
Implementation of the FAR-25 damage-tolerance requirements resulted in a 
21% reduction in allowable stress level and set an inspection interval of 
20% of the design lifetime. 

Figure I shows that the probability of failure, for a mean service 
life equal to the design life, is 1.4% for the safe-life design while it 
is only 0.002% for the location designed according to the damage 
tolerance criterion. As the mean service life of the fleet increases, so 
does the probability of failure increase. Figure 1 indicates, for a mean 
service life equal to twice the design life, the probability of failure 
is 31% for the location designed to the safe-life criterion. The 
corresponding value for the location designed to be damage-tolerant is 
only 0.04%. 

There is a commonly expressed belief that a structure, designed to the 
damage-tolerance requi rements, is not affected by an extension in service 
life, since the assumed fatigue damage reverts to a predetermined value 
after each inspection that did not detect a crack. If this is true, there 
need not be any limitations on the acceptable service life of an 
aircraft. Even without considering corrosion damage, which is time 
dependant, the total life view of INSIM shows that this premise is not 
true, and the probability of failure increases with increased service 
life. This is obviously due to the fact that, for the overwhelming number 
of locations (more than 99%), aircraft can be expected to retire from 
service without any cracks being detected, as is shown in Table 2. As the 
service life increases with respect to the design life, less aircraft 
retire without cracks being detected. Most of the difference is 
reflected by the number of cracks detected by NDI. However, it is 
inevitable that some of the difference is accounted for by unsuccessful 
inspections which lead to service failures. Therefore, it is clear that 
the probability of failure increases with service usage — even in 
locations designed according to the damage-tolerance criteria. 


TABLE 2. Typical Distribution of Possible Outcome at a Location 


POSSIBLE OUTCOME AT LOCATION 

MEAN SERVICE LIFE / DESIGN LIFE 

1.0 

1.5 

2.0 

Retired from service before 
detection of crack 

99.97% 

99.73% 

99.06% 

Crack detected by NDI 

0.03% 

0.25% 

0.90% 

Failure in service 

0.00% 

0.02% 

0.04% 

TOTAL 

100.00% 

100.00% 

100.00% 

. _ . 
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As usage severity increases, it can be expected that the probability 
of failure will increase. This is illustrated in Figure 2 for locations 
designed according to the safe-life and damage-tolerance criteria. Usage 
severity is characterized here by an increase in the spectrum stress 
level. As is shown in Figure 2, under a 20% increase in usage severity, 
the probability of failure for the safe-life design can reach 55%. For 
the damage-tolerance design, even under these adverse conditions, the 
probability of failure only reaches 0.13%. 
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Figure 2. Effect of usage severity on probability of failure. 


These studies, assisted by the INSIM program, demonstrate that the 
damage-tolerance methodology can be considered to be the primary strategy 
for minimizing service failures. As is shown in Figures 1 and 2 - t even 
under adverse conditions of extended service life and usage severity, 
reasonable probabilities of failures can still be achieved. 
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The Inspection Threshold — Friend or Foe? 


It is FAA practice to permit, under certain circumstances, delaying 
the initial inspection to 50% of the design life (See Reference 2). This 
initial inspection is often called the "inspection threshold". 

The concept of an inspection threshold obviously appeals to the 
manufacturer and operator, who can delay maintenance to a later date. It 
is assumed that there is only a very small probability that cracks will 
be detected early in an aircraft designed to be damage-tolerant. 
Therefore, the initial inspection can be safely delayed until 50% of the 
design life has been reached. 

This premise has been studied, using the INSXM computer program, and 
the results are shown in Figure 3. The parameters used are typical 
results for a location designed to be damage-tolerant. The mean service 
life was taken to be equal to the design life. Inspections are performed, 
after the threshold inspection, at intervals of 20% of the design life. 


PROBABILITY OF FAILURE (%) 



Figure 3. Effect of threshold inspection on the probability of failure. 
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Figure 3 indicates that the probability of failure remains nearly 
constant for conditions ranging from no threshold inspection to delaying 
the threshold inspection to 75% of the design life. In fact, for 
threshold inspections between 40% and 70% of the design life, there is a 
slight reduction in the probability of failure. This unexpected 
phenomenon can be explained by the fact that the presence of a threshold 
inspection may place the remaining inspections at points on the crack 
growth curve where crack detection is more probable. Only when the 
threshold inspection is scheduled for later than 75% of the design life 
does the probability of failure begin to rise rapidly. 

As a result of this study, and similar studies performed using INSXM 
over a wide range of parameters, it can be concluded that there is no 
adverse effect in scheduling the threshold inspection at 50% of the 
design life for aircraft that have been designed to damage-tolerance 
requirements . 


Customized Inspections for Minimizing the Probability of Failure 


In spite of the virtues of the damage-tolerance methodology in 
minimizing the probability of failure, adverse situations exist in which 
conventional inspection intervals are insufficient. In such a case, 

XNSIM can be used to select a customized inspection schedule which will 
reduce the probability of failure to an acceptable level. This will be 
demonstrated using two examples. 

The first example deals with a 2024-T3 plate having several fastener 
holes. A crack will develop at one fastener hole, eventually severing the 
ligament and then continue to grow from the opposite side of the hole. 

The crack continues to grow until it reaches a size critical under 
service loads, and then failure occurs. Using conventional damage 
tolerance criteria, the threshold inspection was selected to be 50% of 
the design life and subsequent inspection intervals were selected to be 
20%- of the design life, using a liquid penetrant NDI method. Figure 4 
indicates the probability of failure for this location which is 
designated location "A 1 ' . 

When the mean service life equals the design life, Figure 4 indicates 
that the probability of failure would be 0.05% without any inspections. 
This is due to the relatively large mean crack initiation life of nearly 
four design lifetimes. When the inspections prescribed by the damage 
tolerance criteria are applied, the probability of failure drops to 
0 . 01 %. 


As the mean service life increases, the probabilities of failure 
likewise increase, as is illustrated in Figure 4. When the mean service 
life reaches twice the design life, the probability of failure is 0.55%, 
even though the inspections are performed in accordance with the damage 
tolerance requirements. This probability of failure is excessive, and 
should be reduced. Several customized inspection schedules were studied 
with the assistance of XNSIM. Table 3 describes the customized 
inspection schedule which seemed to be the most cost-effective. 
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PROBABILITY OF FAILURE -(%) 
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Figure 4. Probability of failure for location "A". 


TABLE 3. Customized Inspection Schedule for Location "A" 
(All inspections are performed using liquid penetrant) 


SERVICE LIFE / DESIGN LIFE 

INSPECTION INTERVAL / DESIGN LIFE 

0.50 

Threshold Inspection 

0.50 - 1.00 

0.20 

1.00 - 1.50 

0.15 

1.50 - 2.00 

0.10 

2.00 - 

0.05 
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The customized inspection begins with the conventional threshold and 
inspection interval, as dictated by damage-tolerance requirements. With 
each extension in service life, the interval is reduced, as is shown in 
Table 3. Figure 4 describes the effect of the customized inspection 
schedule on the probability of failure. When the mean service life 
equals the design life, the customized schedule has no real effect. 
However, when the mean service life reaches 1.5 times the design life, 
the probability of failure is reduced from 0.12% to 0.033%, as is shown 
in Figure 4. When the mean service life reaches twice the design life, 
the customized inspections reduce the probability of failure from 0.55% 
to 0.06%. This is a very significant reduction in the probability of 
failure. This example demonstrates how a specific inspection strategy, 
of reducing the inspection interval as service life is extended, can be 
selected to minimize the probability of failure. 
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Figure 5. Probability of failure for location "B". 
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The second example deals with a 7475-T73 wing skin panel at an access 
hole. Cracks developing at the edge of the hole will propagate and 
eventually result in a failure of the panel. Conventional damage 
tolerance analysis set the threshold inspection at 50% of the design life 
and the inspection interval at 15% of the design life. Inspections are to 
be performed visually. Figure 5 describes the probability of failure for 
this area, which is designated location "B". 

When the mean service life equals the design life, Figure 5 indicates 
that the probability of failure is only 0.013% even without any 
inspections. When the above inspections are performed, the probability 
of failure is virtually zero. 

However, as the service life increases, the situation begins to 
deteriorate. When the mean service life equals twice the design life, 
the probability of failure increases to 8.0% for no inspections and 0.31% 
when the prescribed inspections are performed, as is shown in Figure 5. 

By using INSIM to study various inspection strategies, it was concluded 
that the addition of an ultrasonic inspection, at the end of each design 
life, would reduce the probability of failure signi ficantly . 

Figure 5 indicates that when the mean service life is twice the design 
life, this supplementary inspection will reduce the probability of 
failure from 0.31% to 0.067%. 

These two examples demonstrate two ways that customized inspections 
can be used to reduce the probability of failure significantly. The 
first method is to continuously reduce the inspection interval as the 
service life increases beyond the originally determined design life. The 
second method is to add supplementary inspections at specific intervals 
of service usage. In both cases the INSIM computer program was used to 
evaluate the improvement to the probability of failure. 
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